Enforcing Device Trust on Code Changes | Figma Blog
Figma built a custom system to ensure that code merged into GitHub release branches originates from trusted, company-managed devices. Standard SSO, WebAuthn, dual-control approvals, and GitHub’s “Verified” commit status did not sufficiently protect against compromised tokens, SSH keys, or sessions. The team instead combined short-lived Okta Device Trust certificates with X.509/S/MIME Git commit signing. ## Protecting Production Release Branches - GitHub release branches are the source of truth for production deployments and therefore a high-value attack target. - Figma requires dual control for pull requests: the author and another engineer must approve changes. - GitHub access is protected by SSO and WebAuthn 2FA. - These controls do not fully address compromised: - Personal access tokens - OAuth tokens - SSH keys - Existing GitHub sessions ## Problems with GitHub Commit Verification - GitHub’s commit verification can provide a “Verified” status without proving that the commit came from a trusted company device. - Engineers’ personal GPG keys are outside Figma’s control and cannot be tied to a specific managed laptop. - Commits created through GitHub’s web interface or API may be signed with GitHub’s own web-flow GPG key. - An attacker using a compromised OAuth app, session, token, or SSH key could potentially create commits that GitHub marks as verified. - Building an internal verification system gives Figma more control over what qualifies as a trusted change and avoids manually monitoring every credential type. ## Okta Device Trust Certificates - Figma’s Endpoint Security Baseline includes requirements such as: - Current browser versions - The latest macOS version - Active malware protection - Figma issues X.509 device certificates to company-managed MacBooks through an Amazon Private Certificate Authority. - Certificates are distributed using JAMF and renewed every 15 days. - Each certificate attests that the device met the security baseline when the certificate was issued. - Okta Identity Engine uses these certificates to enforce device trust for sensitive services including AWS, Stripe, and Snowflake. - Because the certificates can sign data, Figma can also use them to attest to actions outside Okta. ## Signing Git Commits with Device Certificates - Figma investigated using its device trust certificates to sign Git commits through S/MIME. - GitHub’s `smimesign` utility supports X.509-based commit signing on macOS and Windows. - It uses certificates and private keys stored in the macOS Keychain or Windows Certificate Store. - Git can be configured with: ```sh git config commit.gpgsign true git config gpg.format x509 git config gpg.x509.program smimesign git config user.signingkey <your_x509_key_id> ``` - This approach initially presented a usability problem: certificates—and therefore signing keys—change every 15 days when device trust certificates renew. - The excerpt ends as Figma begins describing how it planned to dynamically select the latest signing key so engineers would not need to update their Git configuration manually. Figma’s approach strengthens commit verification by linking code signatures to short-lived certificates issued only to compliant, company-managed devices. This is more meaningful than relying solely on GitHub’s generic “Verified” status, though the provided excerpt does not include the final implementation details.
Read original(opens in new tab)